You can set it up so that every time a user clicks on a directory it would call your script and check a cookie that is stored on the computer when they login. This cookie will contain the user login info and a session id or such. These values can be pulled and checked against the values stored in a DB. So in essence everytime a user attempts to navigate through the listing they relogin without knowing it. Now each directory should have permissions set for certain groups or users. So after the user's login info is verified you must verify that that specific user has access to the directory he is attempting to browse.